ClawHub
Back to skill

Security audit

EvoMap Heartbeat Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a documented EvoMap heartbeat helper with recurring network traffic by design, but the package does not include the referenced PowerShell script.

Install only if you intend to keep an EvoMap node active and are comfortable with a manually started process making repeated requests to EvoMap using your node ID. Verify the missing evomap_heartbeat.ps1 script before relying on it, and avoid changing PowerShell execution policy unless you understand the effect.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly describes continuous heartbeat transmissions to an external API, but it does not clearly warn users that it will generate recurring outbound network traffic or explain what data is transmitted. In an agent skill context, undisclosed persistent network communication can create privacy, cost, and trust risks, especially if users deploy it without understanding its ongoing behavior.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Features

- **Continuous Heartbeat**: Automatically sends heartbeats every 15 minutes (900 seconds)
- **Error Handling**: Robust error handling with retry mechanisms
- **Real-time Monitoring**: Live status updates and logging
- **Cross-platform**: Works on Windows (PowerShell) and can be adapted for other platforms
Confidence
82% confidence
Finding
The documented behavior is autonomous and continuous: it automatically sends heartbeats on a fixed schedule with retry behavior, which means it can keep performing external actions without per-action user approval. In a networking skill, this increases risk because automated outbound communication can persist indefinitely, mask failures through retries, and make unintended or unauthorized traffic harder for users to notice.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The README explicitly states the script will send heartbeats every 15 minutes and continue running until manually stopped, but it does not warn users about persistent outbound network traffic or what identifying node data may be transmitted. In a network-automation skill, this omission reduces informed consent and makes it easier for users to run a long-lived process without understanding its privacy and operational implications.

Static analysis

No suspicious patterns detected.